DorrisCan this break my store?
What the app the kit gives you does and doesn't do to your Shopify store, and how to cut it off in under a minute.
- Free
The short answer: as the kit gives it to you, the app looks at your Shopify store and changes nothing in it. Its connection is read-only, on purpose. Letting it change things is yours to switch on later, with your agent.
What the app can do in your store
It looks up an order and its tracking and shows them beside a customer's message. The permissions your store grants it are read permissions, so nothing in it edits, refunds or cancels. Until you connect your store, it runs on made-up data: a sandbox.
What can go wrong
A bug in a read-only app leaves your store alone. What it can do is show you something wrong, which you then copy into a real reply. So the app fails out loud: when it doesn't reach your store it shows the error, never quiet sample data.
What your agent can touch
Your agent is not the app. It's an AI that reads and writes files on your computer while you watch, and it can be confidently wrong at speed: read what it proposes, ask why, and stop it when you need to. Through the app's connection it can still only read your store. If it makes a mess of the app's files, Something broke has the prompt that takes you back.
Keep its key secret
The app reaches your store with a secret, and anyone holding it can read what your app reads. Keep it out of every chat. If one slips in, replace the key first, then tidy up. Something broke has that prompt too.
When you add more
Read-only describes the app the kit gives you, not everything you build on it. Some tools in the Library act on their own, like back-in-stock emails and invoices. Treat every new permission as a decision.
Add AI-drafted replies and watch for prompt injection: words in a message written to give orders to whatever AI reads them. The defense is that a draft has no power to act; a person reads it and sends it.
Can I build tools like this without coding?
Yes, that's what the kit is for: you say what you need and your agent writes it. What keeps it safe is what you let the app do. As the kit gives it to you, it only reads your store. Each new thing you add that acts on its own, like emails or invoices, is a decision about a new permission, so treat it as one. Keep the app's key out of every chat, and know that you can cut the app off in under a minute.
Cutting it off, in under a minute
Uninstall the app from your store and Shopify takes away its access. Your store is untouched, because the app only ever read.
Something broke says where to find the app in your store. For a hand, paste walk me through a dashboard and your own agent will guide you through it.